CVE-2023-41881: vantage6 does not properly delete linked resources when deleting a collaboration
(updated )
When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.
This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.
References
- github.com/advisories/GHSA-rf54-7qrr-96j6
- github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-200.yaml
- github.com/vantage6/vantage6
- github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst
- github.com/vantage6/vantage6/commit/cce9538f8b70e814c080dd0ae43b297f3af8a732
- github.com/vantage6/vantage6/pull/748
- github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6
- nvd.nist.gov/vuln/detail/CVE-2023-41881
Code Behaviors & Features
Detect and mitigate CVE-2023-41881 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →